We are currently testing the integration of Idira (ISPSS) with RRD for usability. RRD 2026 - Version 19.0.8966.1 Patch 3
The configuration was successful, and we were able to log in, retrieve credentials, and use them within RRD.
However, after approximately 30 minutes, a popup appears with the following message: "Token expired - do you want to authenticate again?"
I have already searched the forum and reviewed the available documentation but could not find any information about this behavior or a related configuration setting.
Is this a setting that can be configured within RRD?
No that should be Cyberark configuration - we authenticate the user and get a Token back - but the Token will expire - and the time you should set in Cyberark
(26-08-2026, 08:28 AM)DevOma Wrote: No that should be Cyberark configuration - we authenticate the user and get a Token back - but the Token will expire - and the time you should set in Cyberark
That’s unexpected, as far as I know, we don't have a 30-minute token expiration or session lifetime limit. When signed into CyberArk/Idira (using the same login credentials as RRD), we aren't forced to re-authenticate every 30 minutes, even when idle.
But there must be any session token lifetime limit - don't know if it is in Cyberark or Idira - we have several customers who are using Cyberark and RRD - no complaints about re-auth
(26-08-2026, 09:30 AM)DevOma Wrote: But there must be any session token lifetime limit - don't know if it is in Cyberark or Idira - we have several customers who are using Cyberark and RRD - no complaints about re-auth
They have officially rebranded CyberArk as Idira following the acquisition by Palo Alto Networks, but the underlying product remains the same.
The access token appears to be intentionally short-lived, which aligns with security best practices. Refresh tokens typically have a much longer lifetime and are designed to obtain new access tokens without requiring users to re-authenticate.
Based on the RRD logs, I do not see any indication that RRD/WebView2 is using refresh tokens to automatically renew access tokens.
My understanding is that you have several customers using the RRD extension with Idira Privilege Cloud (ISPSS). They may not be experiencing this issue because their access token lifetime is configured differently.
From my perspective, the ideal solution would be for the RRD extension to either:
Automatically refresh access tokens using refresh tokens, similar to the Privilege Cloud portal.
Prompt users to continue their session and refresh the token when needed. The official Idira plugin I am also evaluating appears to work this way.
I suspect the difference here is related to token lifetime settings. However, extending the access token lifetime would likely be a difficult discussion with the security team, while requiring MFA re-authentication every 30 minutes would be an unacceptable user experience. Therefore, I am looking for a solution that balances security and usability through token refresh mechanisms rather than simply increasing token lifetime.
I asked Copilot for refresh-token function for that setup - here the answer
with that setup (CyberArk Cloud + Entra ID federated IdP + SAML 2.0), the answer is:
• No true token refresh (no refresh_token flow exposed in your current CyberArk SAML path).
• What you can do is only re-authenticate (run SAML login again), not refresh in-place.
For this specific environment:
• Fully silent background renewal is generally not guaranteed.
• It may work sometimes if Entra already has a valid browser session and no MFA challenge is triggered.
• If MFA / Conditional Access is required, user interaction will be required again.
In your current code, this is exactly what happens: on 401, it prompts via AskForLogonAgain() and calls LogonCyberArk().
If needed, this can be improved to proactive re-auth before expiry (e.g., 25 min timer) to reduce failures, but it is still re-auth, not real refresh
From what I’ve seen in our logs, CyberArk actually does issue access and refresh tokens right after Entra ID completes the SAML handoff. Looking at the RRD logon logs, WebView2 captures them directly:
AuthForm;Navigated to: https://*****.cyberark.cloud/*****
AuthForm;Cookies captured: refreshToken...
AuthForm;Cookies captured: 49. IdTokenFound: True.
Login;Token:......
We also see this same auth flow working with the Idira plugin from Idira, it uses WebView2 as well and allows us to simply resume the session without a full re-auth. (:: Beginning session token refresh sequence... Token refresh has completed successfully)
Because the refresh token and session cookies are present, it seems technically possible for RRD to leverage them to silently resume/extend the session, rather than falling back to a full re-authentication prompt via AskForLogonAgain().
Just to let you know, I tested the new Patch 4. Now it is behaving even worse: after logging in, any action on a folder or connection triggers a "token expired" error.
Rocket Remote Desktop 2026 - Patch 4 (19.0.9012.1) is available!
